Canvas Breach May Put 275M Users, 9,000 Schools at Risk

"ShinyHunters gave Instructure a deadline and a threat: 'FINAL WARNING PAY OR LEAK.' The group claimed the stolen data includes PII connected to students, teachers, and staff, plus 'several billions of private messages' exchanged by Canvas users."

"The private-message claim adds a more sensitive category of data to the alleged breach. Canvas messages could reveal how students and teachers communicate during the school day, from assignment questions and feedback to academic concerns or extension requests."

"Steve Proud, Instructure's chief information security officer, said the company 'recently experienced a cybersecurity incident perpetrated by a criminal threat actor' and brought in outside forensics experts to investigate."

Instructure confirmed a cybersecurity incident involving Canvas LMS user information and messages. Hackers, known as ShinyHunters, claimed to have stolen data from 275 million users and nearly 9,000 schools. The breach includes sensitive personal information and billions of private messages. Instructure has not verified the scale of the breach or the claim regarding its Salesforce instance. The exposure of private messages raises concerns about the nature of communications between students and teachers. Instructure is investigating the incident with outside forensics experts.

Read at TechRepublic